[tuwtuwtuwtuw]

Okay, but that is then about authorization and not about "identity". I agree that treating it as a secret is a bad idea.

The person said SSN and equivalents, so I guess it depends on what is meant by equivalents.

Where I live my personal number is used as identity, but to actually prove I am the owner of it another mechanism is used (private keys embedded in certs). The personal number is very public info by design and can't be used as a secret.

[lcnPylGDnU4H9OF]

If my web identity was my personal government tax identification number, I would be worried that one could use that to fraudulently and successfully claim to be me with a fair number of institutions because the authentication mechanism is lacking efficacy.

[tuwtuwtuwtuw]

Yes, I understand, but you mix up identity with proof of identity.

My non-web identity is my name. But me saying that my name is John Doe is not a proof that this is my name. In the same way, me saying that I have identification number 12345678 isn't proof that I actually have that number.

As I wrote, I have a government issued identification number. This number can be looked up by any citizen in the country since it's public info. You can even look it up online - it's not secret.

But someone knowing the number doesn't mean they can prove it is their number, because proof of identity is not in the number itself - for that we use public/private keys and other secure mechanisms.

I understand that this is not how it works in the US because some organization treats the SSN as secret. But that's not an issue with government issued identity number as a form of identity, it's an issue with the US system. Other countries does not have the same issue, since they didn't mix up identity with proof of identity.

[Joker_vD]

Many people don't want their online identities be easily connected to their offline identity (or even with each other). Hell, you yourself didn't register on HN with your G.I. ID's serial number for some reason, did you?

[tuwtuwtuwtuw]

Sure, but this specific part of the discussion was about it being a bad choice because "it’s treating the identifier like a password that is problematic", which I objected to.

I do agree that in many cases I would not want to use it as my web identity. (Those cases would also overlap pretty well with cases where I don't want to use my own email address, like when signing up for sites like this, reddit, Twitter and similar).